Node.js spawns detached hidden child process from node_modules

Ibrahim Saud@tektrix

•updated Sep 21, 2026•1•0•2

Detects a Node.js process spawning a detached, hidden child node.exe process from within a node_modules directory, a technique observed in the indexed-btree npm supply-chain malware to establish a stealthy runtime loader.